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DATA PROTECTI ON ACT 1998 


SUPERVI SORY POWERS OF THE I NFORMATI ON COMMI SSI ONER 


MONETARY PENALTY NOTI CE 


Studios MG Limited 


3 Shortlands, Shortlands, Hammersmith, London W6 8DA 


The Information Commissioner (“Commissioner”) has decided to issue 
Studios MG Limited (“SMG”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is in relation 
to a serious contravention of Regulation 22 of the Privacy and 


Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


SMG, whose registered office is given above (Companies House 
Registration Number: 09417715) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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“(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 
products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


Section 11(3) of the DPA defines “direct marketing” as “the 
communication (by whatever means) of any advertising or marketing 
material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)). 


Consent is defined in the European Directive 95/46/EC as “any freely 
given specific and informed indication of his wishes by which the data 
subject signifies his agreement to personal data relating to him being 
processed”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive) (Amendment) Regulations 2011 and 
the Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
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(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the |CO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


SMG have advised that they are a software design and build 


consultancy based in London. 


SMG first came to the attention of the Commissioner after the reporting 
of an unsolicited email being received by a subscriber on 30 April 2020 


advertising the sale of surgical masks. The unsolicited email identified 
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the sender as SMG, with a link directing recipients to the website 


‘surgicalmaskslondon.com’. 


The Commissioner sent an initial investigation letter to SMG on 4 May 
2020 which detailed her concerns regarding the complaint, and 
requested full details of SMG’s direct marketing campaign, and 
evidence of any consent relied upon. Details of SMG’s PECR policies 


and procedures were also requested. 


SMG acknowledged receipt of the initial investigation letter on 4 May 
2020, leaving a short voicemail stating that, in respect of the 
complainant, his data had been obtained from “a different campaign 


related to tennis”. 


SMG then provided a short substantive response to the Commissioner’s 
letter on 5 May 2020. This response advised the Commissioner that a 
single email was sent out to a database of contacts which had been 
“gathered over the years”. SMG confirmed that the email was sent to 
“around 8,000 people” but that the data had now been deleted so it 
could not be sure. In addition, SMG confirmed that it’s ‘email marketing 
solution’ (“platform provider”) had also been cancelled. In response to 
the Commissioner’s request for evidence of any consent being relied 
upon for the sending of the emails, SMG responded simply that it does 
not have any evidence of consent. No details of any PECR policies or 


procedures were provided. 


Having received this response, the Commissioner on 5 May 2020 
requested further information from SMG, in particular regarding the 
sources for the contacts in SMG’s database, details of the type of 
business SMG conducts, and details of the exact number of emails 


sent. The Commissioner noted that SMG had also previously claimed 
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that the complainant’s data had originally been obtained from a 


campaign ‘related to tennis’; further details were requested about this. 


SMG responded on 9 May 2020 advising that its database was gathered 
“via things like LinkedIn connections, events, people that emailed me, 


"m 


etc.”. It also confirmed that is a small software design and build 
consultancy. In response to the request for the exact number of 
emails sent, SMG stated again that its account with its platform 
provider had been deleted, but that between 8,000 - 9,000 people 
(whose data was obtained from “several sources”) would have been 
sent the email. SMG advised that “many of them were out of date and 
bounced” but provided no evidence of this. In relation to the origin of 
the complainant’s data, SMG now advised that it did not know how it 


came to have the email address. 


In an effort to confirm the precise volumes for the messages sent by 
SMG, the Commissioner on 13 May 2020 contacted the platform 


provider directly, however, to date a response has not been received. 


On 20 May 2020 the Commissioner advised SMG that it should still be 
able to obtain the volumes from its platform provider, despite deletion 
of its account. The Commissioner asked that SMG also elaborates on 
its statement that its database consisted of data obtained from ‘several 


sources’; to date, no response has been received. 


On 5 June 2020 the Commissioner made a short enquiry with the 
complainant in this case to enquire as to how his details may have 
come into the possession of SMG. The complainant responded that day 
to advise that he had signed up to a now-defunct tennis website in 
2015 (“http://londontennis.co.uk/”), and that he had subsequently 
received four emails from a separate organisation (‘Aceify Limited’, via 


“Aceify.me”), for which he had not signed up, offering similar services 
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to that website. The Commissioner is aware that the director of SMG is 


also a director of Aceify Limited (which operates “Aceify.me”). 


The Commissioner notes that of the two websites known to have been 
used by SMG for the purposes of its personal protective equipment 
sales, ‘surgicalmasksuk.org’ now appears to be inactive and redirects 
individuals to ‘surgicalmaskslondon.com’. The price of the facemasks 
sold on that website have now almost halved from the price advertised 


at the outset of the Commissioner’s investigation. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by SMG and, if so, whether 


the conditions of section 55A DPA are satisfied. 

The contravention 

The Commissioner finds that SMG contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


The Commissioner finds that on 30 April 2020 there was one direct 
marketing email received by a subscriber, capable of being evidenced 
by a complaint. The Commissioner finds that SMG transmitted the 


direct marketing message, contrary to regulation 22 of PECR. 


SMG has confirmed however that between 8,000 to 9,000 such direct 
marketing emails were sent on 30 April 2020, but has failed to provide 
precise figures for those direct marketing messages that were received 


by subscribers. 
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SMG, as the sender of the direct marketing, is required to ensure that 
it is acting in compliance with the requirements of regulation 22 of 


PECR, and to ensure that valid consent to send those messages had 


been acquired. 


In this instance SMG has stated only that it does not hold any evidence 
of consent for the individuals to whom it engaged in its one-day direct 


marketing campaign. 


SMG has indicated that the data it used had been gathered over a 
number of years from various sources, including but not limited to 
“LinkedIn connections, events, [and] people who had emailed [the 
director]”. It is apparent to the Commissioner that SMG’s direct 
marketing campaign was therefore made possible by using data which 
had been scraped from various vaguely defined sources. SMG made no 
apparent effort to obtain consent for the direct marketing that it sent 
on 30 April 2020, and indeed it would appear from the account given 
by the complainant in this instance that data could have been 
harvested from sources which had previously sought to provide 


services as wide ranging as tennis tuition. 


The Commissioner is further satisfied that SMG cannot rely on the ‘soft 
opt-in’ exemption provided by Regulation 22(3) PECR for the purposes 
of the messages sent. Whilst SMG state that data was obtained from 
several sources, it is itself a ‘software design and build consultancy’, 
and this would appear to bear no relation to the sale of personal 
protective equipment which SMG sought to conduct with its direct 


marketing messages on 30 April 2020. 


In short, SMG has provided no evidence to support a reliance on 
Regulation 22(3) PECR, or any evidence to demonstrate valid consent 


whatsoever. 
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The Commissioner would also note that, upon receiving the 
Commissioner’s initial investigation letter, SMG advised her that it had 
deleted its database, and its platform provider account, essentially 
removing any chance of accurately relaying to the Commissioner the 
total volume of messages delivered to affected subscribers. As such it 


is impossible to determine the total number of individuals whose 


privacy had been impacted by the actions of SMG. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because on 30 April 2020, a confirmed total 
of one direct marketing message was sent by SMG, as evidenced by a 
complaint. This message contained direct marketing material for which 


the subscriber had not provided adequate consent. 


The ‘Information Commissioner’s guidance about the issue of monetary 
penalties prepared and issued under section 55C(1) of the Data 
Protection Act 1998’ makes clear that an objective approach will be 
taken in considering whether a serious contravention of PECR has 
taken place, and that a single breach may be sufficient to meet this 
threshold. The Commissioner is satisfied from the evidence before her 
that as many as 9,000 emails may have been sent on 30 April 2020 
regarding the sale of facemasks for profit, however because of the 
actions of SMG in deleting the database, and cancelling its account with 
its platform provider following the initiation of the Commissioner’s 
investigation, it is now not possible to calculate the full extent of the 


contravention. The fact that there was only a single complainant is not 
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necessarily reflective of the gravity of the potential breach, since it is 
reasonable to expect that only a very small proportion of those who 
receive an unsolicited direct marketing email for which they have not 


consented will take the necessary steps to report it, with the majority 


likely to either delete, or ignore it. 


The domains used by SMG for its activities were registered on 23 March 
2020, in line with the commencement of the COVID-19 lockdown 
period, and the Commissioner has taken the view that the direct 
marketing which SMG sought to carry out intended to capitalise on the 
health pandemic, and maximise business by using any data it could 


obtain to reach as many subscribers as possible. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that in this case SMG did deliberately 
contravene regulation 22 of PECR. It would appear that SMG, a 
‘software design and build consultancy’, sought to profit from the 
current national health emergency by obtaining and selling personal 
protective equipment at a premium (as evidenced by the significant 
price reduction in its wares following the Commissioner's investigation). 
Whilst SMG has stated that it obtained data from several sources, it 
has not elaborated on this despite being asked to do so, and from the 


account of the complainant it would appear to be reasonable to suggest 
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that these sources include other businesses for which the director is 


also involved. 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, she has considered whether SMG knew or ought reasonably to 
have known that there was a risk that these contraventions would 
occur. She is satisfied that this condition is met, not least since the 
issue of unsolicited emails have been widely publicised by the media as 
being a problem. It is also apparent that SMG’s director appears to 
have a significant background in the area of ‘direct marketing’, noting 
not least that he was previously the director of an organisation called 
‘Limetree Digital Marketing’ (now dissolved). As such it is reasonable 
to expect that the director of SMG would have some knowledge of the 
laws surrounding direct marketing, and should be aware of the risks 


surrounding such activity. 


Beyond the above, the Commissioner has published detailed guidance 
for those carrying out direct marketing explaining their legal obligations 
under PECR. This guidance gives clear advice regarding the 
requirements of consent for direct marketing and explains the 
circumstances under which organisations are able to carry out 
marketing over the phone, by text, by email, by post, or by fax. In 
particular it states that organisations can generally only send, or 
instigate, marketing messages to individuals if that person has 


specifically consented to receiving them 


It is therefore reasonable to suppose that SMG should have been aware 


of its responsibilities in this area. 
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Secondly, the Commissioner has gone on to consider whether SMG 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


Such reasonable steps in these circumstances could have included 
putting in place appropriate systems and procedures to ensure that it 
had the specific consent of those to whom it had sent marketing 
emails; and adequately recording the source of the data used and 


evidence of any consent obtained. 


Instead, SMG have failed to provide any evidence of consent for the 
direct marketing messages sent to subscribers, indeed it appears 
reasonable to suggest that SMG engaged in its direct marketing 
campaign without giving any consideration at all to obtaining the valid 
consent of those individuals it sought to contact. It harvested its data 
from a variety of vaguely defined and wide ranging sources, some of 
which would appear to include other companies under the director’s 
control, with the aim of advertising personal protective equipment for 
sale to as many individuals as possible at a time when the Government 
was in the process of implementing a national lockdown in response of 
the COVID-19 emergency. SMG failed to retain its database, indeed 
actively deleting it following the Commissioner's initial investigation 
letter; and cancelled its account with its platform provider, failing to 
respond to the Commissioner when she requested that SMG take 


further steps to clarify the volumes of the affected individuals. 


In the circumstances, the Commissioner is satisfied that SMG failed to 


take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 
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The Commissioner’s decision to issue a monetary penalt 


The Commissioner has also taken into account the following 


aggravating features of this case: 


The marketing, relating to the sale of personal protective equipment, 


sought to exploit and capitalise on the current pandemic; 


Given the timing of the registration of the relevant websites, the nature 
of the marketing, the scraping of data from a variety of sources with no 
attempt to obtain valid consent, and the clear divergence from its usual 
course of business, the Commissioner is of the view that the intention of 


the campaign was to profiteer from the COVID-19 pandemic; 


The director of SMG would appear to have significant experience in the 
digital marketing sector. Despite this, there has been a flagrant 
disregard for the privacy rights of the individuals for whom SMG sent 


direct marketing emails without any consent; 


SMG has not registered with the Commissioner’s public data protection 


register; 


Upon receipt of the Commissioner's initial investigation correspondence 
it would appear that SMG deleted the relevant dataset and volumes, and 
closed its account with its platform provider. When later asked by the 
Commissioner to liaise with its platform provider to determine the figures 
for the affected subscribers, SMG simply failed to respond. In 
representations, SMG have claimed that its actions here were not an 
attempt to obstruct the Commissioner’s investigation, but despite this it 
appears that no efforts have since been made to contact its platform 


provider or to now provide the requested figures; 
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SMG stood to make significant financial gains from the sale of its 


personal protective equipment, which it would appear was being offered 


at an inflated price to maximise profit. 


The Commissioner has also taken into account the following mitigating 


feature of this case: 
SMG has advised that it has stopped sending direct marketing emails. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by SMG on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 
monetary penalty on SMG, however, given the limited publicly available 
recent financial information and SMG’s failure to provide any financial 
information beyond its 2019 figures, despite it being requested to do 
so, the Commissioner has been unable to obtain a true picture of 
SMG'’s ability to pay a penalty. The Commissioner would note however 
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that SMG has failed to demonstrate that it will suffer undue financial 


hardship in the event of a penalty. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing emails is a matter of significant public concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. The issuing of a monetary penalty will 
reinforce the need for businesses to ensure that they are only 


messaging those who specifically consent to receive marketing. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £40,000 (forty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 6 November 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
5 November 2020 the Commissioner will reduce the monetary 
penalty by 20% to £32,000 (thirty-two thousand pounds). 
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However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 


Scotland, the monetary penalty can be enforced in the same manner as 


17 


ICO. 


Information Commissioner’s Office 


an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 6th day of October 2020 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8D) 
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Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state:- 


a) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 
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Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 


conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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